Topic starter
24/06/2026 7:37 pm
TL;DR: Claude Code sessions can become unmonitored pipelines between developers, proprietary code, and Anthropic’s API unless organisations add centralized LLM governance, according to Kong. That makes cost, auditability, data leakage, and shadow AI the real programme risks, not the model itself.
Editorial analysis by NHI Mgmt Group, based on content published by Kong: “Governing Claude Code: Secure Agent Harness Rollouts with Kong AI Gateway”.
Key questions
Q: What breaks when Claude Code sessions bypass a central AI gateway?
A: When Claude Code connects directly to a model endpoint, organisations lose consistent policy enforcement, audit logging, data redaction, and cost controls.
Q: Why do AI coding agents create access and governance risk even when they are not autonomous?
A: Because they already operate with tool access, repository access, and execution permissions inside a live workflow.
Q: How can teams tell whether LLM governance is actually working?
A: Look for evidence that model access is scoped, tool use is logged, sensitive outputs are blocked or reviewed, and poisoned context fails closed.
Practitioner guidance
- Implement a central AI gateway for coding agents Route Claude Code traffic through a single mediation layer so authentication, routing, logging, and policy enforcement happen before requests leave the environment.
- Log prompts, responses, and model usage centrally Capture the user, model, token counts, latency, and response metadata for every agent session so compliance and platform teams can reconstruct activity.
- Redact sensitive data before model submission Apply prompt filtering for API keys, environment variables, customer data, and internal project terms so the agent cannot leak them upstream by accident.
Bottom line: Claude Code introduces a governance problem because each session can move code, secrets, and business context through an external model path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:59 am
AI coding governance is becoming a control-plane problem, not an application feature problem. Claude Code changes the shape of risk because it creates high-context, high-volume LLM traffic that needs policy, logging, and enforcement independent of the model provider. Traditional gateway patterns apply, but only if teams accept that the security boundary is now between the developer session and the model endpoint, not inside the IDE. The practitioner conclusion is clear: governance has to sit on the path of every request.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between direct Claude Code access and an AI gateway?
A: Direct access sends prompts and context straight to the model provider, with governance left to each client or team. An AI gateway mediates that traffic, adding unified authentication, logging, filtering, routing, and usage controls. For enterprise use, the gateway turns an unmanaged integration into a policy-enforced control plane.
👉 Read our full editorial: Claude Code governance needs an AI gateway control plane